Controlling access to electronic data assets

Abstract

A computer system is disclosed that provides purpose-based access to electronic data assets. For example, the computer system may perform operations including: receiving, from a first user, a request to access data assets associated with a purpose object; in response to receiving the request from the first user: generating a purpose access request object including at least an identification of the first user and an identification of the purpose object; and providing an indication of the purpose access request object to a second user associated with the purpose object; receiving, from the second user, an approval of the request; and in response to receiving the approval of the request from the second user: updating the purpose access request object to include at least an indication of the approval of the request; and granting the first user access to data assets associated with the purpose object.

What is claimed is: 
     
         1 . A computer-implemented method comprising, by one or more hardware processors executing program instructions:
 determining a first set of access permissions associated with a first user;   determining a second set of access permissions;   comparing the first set of access permissions with the second set of access permissions; and   providing, via an interactive user interface and based on the comparing, a table including a comparison of the first set of access permissions with the second set of access permissions.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein the table includes, in a first column, a listing of access permissions included in the first set of access permissions but not included in the second set of access permissions. 
     
     
         3 . The computer-implemented method of  claim 2 , wherein the table further includes, in a second column, a listing of access permissions included in the second set of access permissions but not included in the first set of access permissions. 
     
     
         4 . The computer-implemented method of  claim 3 , wherein the table further includes, in a third column, a listing of access permissions common to both the first set of access permissions and the second set of access permissions. 
     
     
         5 . The computer-implemented method of  claim 1 , wherein the first set of access permissions indicate associations of the first user with one or more purpose objects and/or data asset objects. 
     
     
         6 . The computer-implemented method of  claim 1  further comprising, by the one or more hardware processors executing program instructions:
 receiving a user input via the interactive user interface; and 
 in response to the user input, updating the first set of access permissions to include at least a portion of the second set of access permissions. 
 
     
     
         7 . The computer-implemented method of  claim 1  further comprising, by the one or more hardware processors executing program instructions:
 receiving a user input via the interactive user interface; and 
 in response to the user input, updating the first set of access permissions to include all of the second set of access permissions. 
 
     
     
         8 . The computer-implemented method of  claim 7  further comprising, by the one or more hardware processors executing program instructions:
 in response to updating the first set of access permissions, associating the first user with all of one or more purpose objects with which the second set of access permissions are associated. 
 
     
     
         9 . The computer-implemented method of  claim 8  further comprising, by the one or more hardware processors executing program instructions:
 further in response to updating the first set of access permissions, enabling the first user to access all data assets associated with the one or more purpose objects. 
 
     
     
         10 . A system comprising:
 one or more computer readable storage mediums storing program instructions; and   one or more processors configured to execute the program instructions to cause the system to at least:
 determine a first set of access permissions associated with a first user; 
 determine a second set of access permissions; 
 compare the first set of access permissions with the second set of access permissions; and 
 provide, via an interactive user interface and based on the comparing, a table including a comparison of the first set of access permissions with the second set of access permissions. 
   
     
     
         11 . The system of  claim 10 , wherein the table includes, in a first column, a listing of access permissions included in the first set of access permissions but not included in the second set of access permissions. 
     
     
         12 . The system of  claim 11 , wherein the table further includes, in a second column, a listing of access permissions included in the second set of access permissions but not included in the first set of access permissions. 
     
     
         13 . The system of  claim 12 , wherein the table further includes, in a third column, a listing of access permissions common to both the first set of access permissions and the second set of access permissions. 
     
     
         14 . The system of  claim 10 , wherein the first set of access permissions indicate associations of the first user with one or more purpose objects and/or data asset objects. 
     
     
         15 . The system of  claim 10 , wherein the one or more processors are configured to execute the program instructions to further cause the system to at least:
 receive a user input via the interactive user interface; and   in response to the user input, update the first set of access permissions to include at least a portion of the second set of access permissions.   
     
     
         16 . The system of  claim 10 , wherein the one or more processors are configured to execute the program instructions to further cause the system to at least:
 receive a user input via the interactive user interface; and   in response to the user input, update the first set of access permissions to include all of the second set of access permissions.   
     
     
         17 . The system of  claim 16 , wherein the one or more processors are configured to execute the program instructions to further cause the system to at least:
 in response to updating the first set of access permissions, associate the first user with all of one or more purpose objects with which the second set of access permissions are associated.   
     
     
         18 . The system of  claim 17 , wherein the one or more processors are configured to execute the program instructions to further cause the system to at least:
 further in response to updating the first set of access permissions, enable the first user to access all data assets associated with the one or more purpose objects.   
     
     
         19 . A computer program product comprising one or more computer-readable storage mediums, the one or more computer-readable storage mediums storing program instructions, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
 determining a first set of access permissions associated with a first user;   determining a second set of access permissions;   comparing the first set of access permissions with the second set of access permissions; and   providing, via an interactive user interface and based on the comparing, a table including a comparison of the first set of access permissions with the second set of access permissions.